Recordbrowser WordPress plugin: Unauthenticated SQL injection via recordid
Summary
The Recordbrowser WordPress plugin up to and including version 1.1.7 does not sanitise and escape the recordid parameter before using it in an SQL query. An unauthenticated remote attacker can append additional SQL queries and extract sensitive information from the WordPress database. Exploitation requires no account and no user interaction, so internet-facing sites with the plugin installed are at risk.
Affected
- Recordbrowser WordPress plugin, all versions up to and including 1.1.7
Fixed in
Unknown. No fixed version is known.
Workaround
- Deactivate and remove the plugin if it is not essential.
- If the plugin must remain active, restrict access to its endpoints to trusted networks or place them behind authentication.
- A WAF or security plugin rule for the recordid parameter may reduce risk; availability of such rules is unverified.
Exploitation
- No evidence of active exploitation found.
- Not listed in CISA KEV according to an automated tracker (not directly verified).
- EPSS about 0.17%.
- Public proof of concept: unconfirmed.
Our recommendation
- Check whether the Recordbrowser plugin is installed on any WordPress site, including staging systems.
- Remove or deactivate the plugin if it is not required, as no fix is available.
- If the plugin is needed, restrict access and apply a WAF rule for the recordid parameter.
- Review web server and database logs for unusual requests; if compromise is suspected, rotate database credentials and WordPress admin passwords.
- Assess whether personal data could have been exposed, which may have data protection obligations under the revDSG.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- OpenCVE CVE-2026-89232 app.opencve.io
- Vulners VulnRichment CVE-2026-89232 vulners.com
- OffSeq radar CVE-2026-89232 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:53.
Original description (NVD)
The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.